Buggy code:
int processCIinCharacterClass ( RangeToken tok , int c ) { } protected RangeToken parseCharacterClass ( boolean useNrange ) throws ParseException { this . setContext ( S_INBRACKETS ) ; this . next ( ) ; boolean nrange = false ; boolean wasDecoded = false ; RangeToken base = null ; RangeToken tok ; if ( ( ( this . read ( ) ) == ( T_CHAR ) ) && ( ( this . chardata ) == '^' ) ) { nrange = true ; this . next ( ) ; base = Token . createRange ( ) ; base . addRange ( 0 , UTF16_MAX ) ; tok = Token . createRange ( ) ; } else { tok = Token . createRange ( ) ; } int type ; boolean firstloop = true ; while ( ( type = this . read ( ) ) != ( T_EOF ) ) { wasDecoded = false ; if ( ( ( type == ( T_CHAR ) ) && ( ( this . chardata ) == ']' ) ) && ( ! firstloop ) ) { if ( nrange ) { base . subtractRanges ( tok ) ; tok = base ; } break ; } int c = this . chardata ; boolean end = false ; if ( type == ( T_BACKSOLIDUS ) ) { switch ( c ) { case 'd' : case 'D' : case 'w' : case 'W' : case 's' : case 'S' : tok . mergeRanges ( this . getTokenForShorthand ( c ) ) ; end = true ; break ; case 'i' : case 'I' : case 'c' : case 'C' : c = this . processCIinCharacterClass ( tok , c ) ; if ( c < 0 ) end = true ; break ; case 'p' : case 'P' : int pstart = this . offset ; RangeToken tok2 = this . processBacksolidus_pP ( c ) ; if ( tok2 == null ) throw this . ex ( "parser.atom.5" , pstart ) ; tok . mergeRanges ( tok2 ) ; end = true ; break ; case '-' : c = this . decodeEscaped ( ) ; wasDecoded = true ; break ; default : c = this . decodeEscaped ( ) ; } } else if ( ( type == ( T_XMLSCHEMA_CC_SUBTRACTION ) ) && ( ! firstloop ) ) { if ( nrange ) { base . subtractRanges ( tok ) ; tok = base ; } RangeToken range2 = this . parseCharacterClass ( false ) ; tok . subtractRanges ( range2 ) ; if ( ( ( this . read ( ) ) != ( T_CHAR ) ) || ( ( this . chardata ) != ']' ) ) throw this . ex ( "parser.cc.5" , this . offset ) ; break ; } this . next ( ) ; if ( ! end ) { if ( type == ( T_CHAR ) ) { if ( c == '[' ) throw this . ex ( "parser.cc.6" , ( ( this . offset ) - 2 ) ) ; if ( c == ']' ) throw this . ex ( "parser.cc.7" , ( ( this . offset ) - 2 ) ) ; if ( ( ( c == '-' ) && ( ( this . chardata ) != ']' ) ) && ( ! firstloop ) ) throw this . ex ( "parser.cc.8" , ( ( this . offset ) - 2 ) ) ; } <START_BUG> if ( ( ( ( this . read ( ) ) != ( T_CHAR ) ) || ( ( this . chardata ) != '-' ) ) || ( ( c == '-' ) && firstloop ) ) { <END_BUG> if ( ( ! ( this . isSet ( IGNORE_CASE ) ) ) || ( c > 65535 ) ) { tok . addRange ( c , c ) ; } else { addCaseInsensitiveChar ( tok , c ) ; } } else { this . next ( ) ; if ( ( type = this . read ( ) ) == ( T_EOF ) ) throw this . ex ( "parser.cc.2" , this . offset ) ; if ( ( type == ( T_CHAR ) ) && ( ( this . chardata ) == ']' ) ) { if ( ( ! ( this . isSet ( IGNORE_CASE ) ) ) || ( c > 65535 ) ) { tok . addRange ( c , c ) ; } else { addCaseInsensitiveChar ( tok , c ) ; } tok . addRange ( '-' , '-' ) ; } else if ( type == ( T_XMLSCHEMA_CC_SUBTRACTION ) ) { throw this . ex ( "parser.cc.8" , ( ( this . offset ) - 1 ) ) ; } else { int rangeend = this . chardata ; if ( type == ( T_CHAR ) ) { if ( rangeend == '[' ) throw this . ex ( "parser.cc.6" , ( ( this . offset ) - 1 ) ) ; if ( rangeend == ']' ) throw this . ex ( "parser.cc.7" , ( ( this . offset ) - 1 ) ) ; if ( rangeend == '-' ) throw this . ex ( "parser.cc.8" , ( ( this . offset ) - 2 ) ) ; } else if ( type == ( T_BACKSOLIDUS ) ) rangeend = this . decodeEscaped ( ) ; this . next ( ) ; if ( c > rangeend ) throw this . ex ( "parser.ope.3" , ( ( this . offset ) - 1 ) ) ; if ( ( ! ( this . isSet ( IGNORE_CASE ) ) ) || ( ( c > 65535 ) && ( rangeend > 65535 ) ) ) { tok . addRange ( c , rangeend ) ; } else { addCaseInsensitiveCharRange ( tok , c , rangeend ) ; } }

Fix:
if ( ( ( ( this . read ( ) ) != ( T_CHAR ) ) || ( ( this . chardata ) != '-' ) ) || ( ( ( c == '-' ) && ( ! wasDecoded ) ) && firstloop ) ) {